Costco supplier traceability requirements (2026 edition)

A producer making single-origin chocolate emailed me after a Costco regional buyer asked for a sample order. Good news, except the follow-up packet landed a week later: a GFSI certificate request, a Costco food safety addendum, an EDI setup form, a pallet-label spec, and a line that said her facility could expect "an audit, possibly unannounced, within the quarter."

Her question is the one I keep getting about Costco:

"Is this just FSMA 204 with a Costco logo on it, or is it something more?"

It's something more. Costco's traceability requirements sit on top of FSMA 204, not inside it. The federal Food Traceability Final Rule sets a floor, and its deadline was pushed to July 20, 2028. Costco did not wait for that floor and is not bound by it. Like Whole Foods, Sprouts, and Erewhon, Costco decided the traceability records matter now, for every supplier, regardless of whether your product is on the Food Traceability List.

This post is the map. If you're a small producer being onboarded by Costco, or you've just been told an audit is coming, here's how the program stacks up, the specific places small producers fail, and what to do before the first audit visit.

The Costco program, in layers

Costco's supplier requirements are a stack, the same way Whole Foods stacks four audits instead of one. The traceability piece is one layer in a larger food-safety and logistics program. You have to clear all of them, but the layers below are where small producers actually trip.

Layer 1: A GFSI certificate is the entry ticket, not the program

Costco requires a current certificate from a GFSI-benchmarked scheme, issued by a certification body Costco accepts, with a scope that actually covers the products and processes you ship them. In practice that means one of:

• SQF (Safe Quality Food): most common for small US producers
• BRCGS: common if you also sell into UK or EU retail
• FSSC 22000: common for ingredient suppliers and co-packers
• IFS Food: less common in the US, accepted

The certificate is the minimum entry ticket. It does not end the conversation. Costco then layers its own requirements on top through the Costco Addendum, a retailer-specific set of expectations scored on top of your GFSI audit. Costco either runs its own food safety audit or accepts an approved third-party audit against that addendum, and for higher-risk categories (ready-to-eat, meat, bakery, fresh-cut) the visit can be unannounced or short-notice. Audit findings feed directly into your approved-supplier status.

Layer 2: The traceability and recall bar

This is the layer this site exists to help with, and the one that has tightened the most. Costco's program expects you to:

1. Trace one step back and one step forward in 2 to 4 hours, not days. Costco's framing is explicit about hours. If your answer involves digging through invoices or a spreadsheet you have been meaning to clean up, you fail.
2. Run mock recalls against worst-case scenarios, including products with complex multi-ingredient supply chains, and keep the documented results.
3. Demonstrate reasonable mass balance: the quantity of an ingredient you received should reconcile against the finished goods you produced and shipped. Big unexplained gaps read as a broken traceability chain.
4. Keep clear, legible, complete records that do not depend on memory or handwritten codes scribbled on a clipboard.

All four map cleanly onto the FSMA 204 concepts. If the difference between a TLC, a KDE, and a CTE is not crisp yet, fix that first, because the mock recall is where it gets tested. Every finished lot needs a traceability lot code (TLC), and you need to produce the Key Data Elements tied to it on demand.

Layer 3: Case and pallet labeling (the GS1-128 / SSCC layer)

This is the layer that surprises small producers, because it has nothing to do with food safety and everything to do with the receiving dock. Costco requires GS1-128 barcode labels on cartons and pallets, each carrying a unique SSCC (Serial Shipping Container Code), the 18-digit license-plate number for a logistics unit. For food and perishable items, the label also carries the lot/batch number.

The catch that costs money: the SSCC on the physical label has to match the SSCC in the EDI 856 Advance Ship Notice (ASN) you transmit before the truck arrives. Costco scans at receiving. If a meaningful share of cartons have unreadable or mismatched barcodes, the chargebacks are real, in the range of $5 to $10 per carton, and more if it slows unloading.

The SSCC is built from your GS1 Company Prefix. That is the one place where Costco's logistics requirement and your FSMA 204 traceability quietly converge: the same GS1 identifiers that label the pallet can carry the lot information your traceability records need. (To be clear, FSMA 204 itself does not require GS1 or a GTIN. Costco's labeling program effectively does. More on that distinction in a post next week.)

Layer 4: The supporting programs that get checked alongside traceability

The Costco Addendum also expects, and the auditor will look for:

• An environmental monitoring program for ready-to-eat and high-risk products: defined zones (1 through 4), sampling plans, action limits, trended results, and aggressive corrective action on positives.
• Foreign-material control: risk-based assessment plus detection (metal detectors, X-ray, vision systems) and documented verification checks.
• Allergen and label control: artwork version control, pre-print checks, and a hard-gated "right label on right product" confirmation in packaging.
• Complaint and incident handling: structured logging, trend analysis, and prompt communication to Costco when something significant happens, with a chronology and corrective actions.
• Data integrity: controlled documents with old versions removed, and electronic records with user IDs, timestamps, and audit trails. No back-dating, no overwriting.

Where small producers actually fail

From talking to operators going through Costco onboarding, the failures cluster in five places. None of them are about your facility being unsafe.

1. The 2-to-4-hour traceback is a someday project. You can describe how you would trace a lot. You have never timed it. On audit day the request is concrete: "pick a finished lot you shipped us last month, show me every ingredient lot in it and every other customer who got that batch, in the next few hours." A filing cabinet answer fails. A spreadsheet you have to reconstruct fails.

2. Mass balance does not reconcile. You received 400 lbs of an ingredient, but the finished-goods math only accounts for 250 lbs, and you cannot explain the gap. To an auditor, an unexplained gap means the lot chain has a hole.

3. GS1-128 / SSCC labels treated as an afterthought. The producer nails the food safety audit, then gets chargebacks because the pallet labels do not scan or do not match the ASN. Nobody warned them the labeling spec was gating, not cosmetic.

4. TLC discipline breaks on rework and repacking. You repack product that did not seal correctly and forget to issue a new TLC for the reprocessed lot. The chain breaks exactly where the mock recall looks.

5. Mock recall report does not exist. Your SQF corrective-action list said "perform annual mock recall." You wrote the procedure. You never ran it. The auditor asks for the report and there isn't one.

What you can skip or answer briefly

Not everything in a Costco packet is gating for a small producer. Some of it is enterprise-tier or informational:

• Blockchain traceability. Nobody small does this. Don't pretend to.
• EPCIS event messaging. Enterprise interoperability. Not expected from a small supplier.
• Full EDI suite beyond the ASN. You need the 856 ASN to match your labels. The rest can often be handled through a low-cost EDI service rather than building it yourself.

If a question is not about food safety, traceability, labeling that gates receiving, or the addendum, it is usually extra credit.

A prep plan before the audit

If a Costco audit is on your calendar, this is the order I would work in.

Week 1: Traceability dry run. Pick three finished lots you shipped in the last 60 days. For each, produce a one-page report: input ingredient lots, production date, finished-lot TLC, all customer ship-tos. Time yourself. If any of the three takes more than 30 minutes, fix the gap now. (On FSMA204Hub this is a screenshot. That is the entire reason the product exists.)

Week 1: Mass balance check. For one high-volume ingredient, reconcile what you received against what you produced and shipped over a month. Find and explain every gap before the auditor does.

Week 2: Mock recall, documented. Pick one ingredient lot. Trace forward to every finished lot it entered, every customer those lots shipped to, and the quantity at each destination. Record start time, end time, gaps found, corrective actions. File the report. This is the document the auditor asks for by name.

Week 2: Labeling and ASN. Confirm your GS1 Company Prefix is current. Generate a test GS1-128 / SSCC pallet label and a matching test 856 ASN. Scan the label. Confirm the SSCC matches the ASN byte for byte. If you don't have a labeling or EDI setup yet, this is the long-lead item, start it first.

Final days: Supporting programs. Pull your environmental monitoring trend sheet (if RTE/high-risk), your foreign-material verification log, your allergen and label-control records, and your complaint log. Make sure each is current, controlled, and legible.

The shortcut nobody tells you

Most of these failures share one root cause: the data you need for the audit lives in your head, in disconnected spreadsheets, or in paper that was never linked together. You can fix that with discipline and a year of practice, or with a system that enforces the lot-to-lot linkage every time a batch moves.

That is the bet behind FSMA204Hub. The compliance score on the dashboard answers the one question a Costco audit really asks: "can you prove, right now, that you know where your lots are?" If it's green, the 2-to-4-hour traceback is a screen-share. If it's amber, you know exactly which batch to fix before anyone asks.

If a Costco audit is on your calendar in the next 90 days, start a free 14-day trial. No credit card. We respond to questions within a working day.

---

Working through a Costco supplier packet right now? Reply to our newsletter or email [email protected] and I'll tell you which layer is the highest risk for your category.

Written by Anas N., Co-founder of Darza Technologies. Last reviewed 2026-06-09.